generally they are used to protect against DDOS and to have forensic data in the case there is malicious behavior and are allowed as essential to operating the service.

But then they can read the logs and track you anyway?

Sure. But that would be against the GDPR if you didn't say you were going to use it for that.

And who is going to check and enforce that?

That is within the domain of the EU governments.

IP addresses are only considered PI if combined with other datapoints.